Vendor incident, severity critical
DebugBear RUM script compromised to serve crypto-draining JavaScript (Polymarket hit)
Published , updated
Attackers compromised DebugBear's infrastructure and used its Real User Monitoring JavaScript to distribute a crypto-draining script, which hijacked authenticated Polymarket trading sessions. Polymarket halted trading and removed the DebugBear integration. DebugBear confirmed an ongoing security incident and told customers to remove the RUM embed code from their websites.
What's affected
- debugbearevery version
What to do
- Remove the DebugBear RUM embed code from your websites
- Check production builds and pages for any references to cdn.debugbear.com or data.debugbear.com
- Review user sessions and wallet or transaction activity for unauthorized actions during the exposure period
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident debugbear-rum-compromise-2026-10References
Notice debugbear-rum-compromise-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.